linux-kernel - Re: [PATCH] uprobes: Fix handle_swbp() vs. unregister() + register() race once more

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181123073402.GA97250@gmail.com>
Date:   Fri, 23 Nov 2018 08:34:02 +0100
From:   Ingo Molnar <mingo@...nel.org>
To:     Oleg Nesterov <oleg@...hat.com>
Cc:     Andrea Parri <andrea.parri@...rulasolutions.com>,
        linux-kernel@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Jiri Olsa <jolsa@...hat.com>,
        Namhyung Kim <namhyung@...nel.org>, stable@...nel.org
Subject: Re: [PATCH] uprobes: Fix handle_swbp() vs. unregister() + register()
 race once more


* Oleg Nesterov <oleg@...hat.com> wrote:

> On 11/22, Oleg Nesterov wrote:
> > On 11/22, Andrea Parri wrote:
> > >
> > > Commit 142b18ddc8143 ("uprobes: Fix handle_swbp() vs unregister() +
> > > register() race") added the UPROBE_COPY_INSN flag, and corresponding
> > > smp_wmb() and smp_rmb() memory barriers, to ensure that handle_swbp()
> > > uses fully-initialized uprobes only.
> > > 
> > > However, the smp_rmb() is mis-placed: this barrier should be placed
> > > after handle_swbp() has tested for the flag, thus guaranteeing that
> > > (program-order) subsequent loads from the uprobe can see the initial
> > > stores performed by prepare_uprobe().
> > > 
> > > Move the smp_rmb() accordingly.  Also amend the comments associated
> > > to the two memory barriers to indicate their actual locations.
> > > 
> > > Signed-off-by: Andrea Parri <andrea.parri@...rulasolutions.com>
> > > Cc: Peter Zijlstra <peterz@...radead.org>
> > > Cc: Ingo Molnar <mingo@...hat.com>
> > > Cc: Arnaldo Carvalho de Melo <acme@...nel.org>
> > > Cc: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
> > > Cc: Jiri Olsa <jolsa@...hat.com>
> > > Cc: Namhyung Kim <namhyung@...nel.org>
> > > Cc: Oleg Nesterov <oleg@...hat.com>
> > > Cc: stable@...nel.org
> > > Fixes: 142b18ddc8143 ("uprobes: Fix handle_swbp() vs unregister() + register() race")
> > 
> > Thanks,
> > 
> > Acked-by: Oleg Nesterov <oleg@...hat.com>
> 
> Yes, but I am not sure this is the -stable material...

So I left the Cc: stable tag intact, because this is a really low-risk 
fix (it just moves barriers around), and clearly fixes a bug that people 
might or might not have observed.

Even if they observed it the race is probably very hard to reproduce and 
almost impossible to report - so we are better off propagating this fix 
to -stable, as there's no realistic actionable way for users to actually 
complain about the bug if it affects them.

That's the general backporting policy for race fixes, unless they are 
really, really intrusive - which this one isn't really.

Thanks,

	Ingo